Extracted

• • Target

    ORDER-2030213F.vbs

  • Size

    227KB

  • MD5

    cfd1f9bddf2a1aac9386621f2df068d5

  • SHA1

    abb692951d21f1820583716dd324de928dfd9b6b

  • SHA256

    164d4f5ae08f512aa6341b37bf57d32bc471415185c63dd175e88a35626b20b6

  • SHA512

    220b962cee21fcbc4049e2a98a2d5cd798820b6be0b5db678d041c7b3a35ce1f2ec0628d770ec812dbb98edccf138d8b3906cf6dd8fbdb4b217b372faf6e3e9f

  • SSDEEP

    768:xMbGEQhUfQB8/UgFcxgfcdVH5xOnxWzi6R/6Y6oHDHrL1V0:WB

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2